Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
From Russia With Code: Disarming Atomic Stealer
Threat Actors
Excerpt
Case Study Atomic Stealer is known to be the first stealer for MacOS devices, it first appeared on Russian hacking in March, 2023. For 3000$ per month, the user gets the access to the panel. The user provides Telegram Bot ID and build ID to the seller and the user receives the build. The stealer allegedly has the following functionalities and features: Login Keychain dump Extract system information FileGrabber (from Desktop, Documents) MacOS Password retrieval Convenient web…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | bf7512021dbdce0bd111f7ef1aa615d5 | Medium | Score 53/100 | First seen |
| MD5 | 57db36e87549de5cfdada568e0d86bff | Medium | Score 53/100 | First seen |
| MD5 | dd8aa38c7f06cb1c12a4d2c0927b6107 | Medium | Score 53/100 | First seen |
| IP | 5.42.65.108 | High | Score 58/100 | First seen |
| IP | 185.106.93.154 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…